This invention relates to a method and system for assisting in the prevention of fraud in a payment card environment. More particularly, the present invention relates to a method and system for detecting merchants at which payment accounts such as credit card accounts may have been compromised—i.e., at which the payment account information may have been stolen.
In today's marketplace, payment cards—such as credit and debit cards—are ubiquitous methods of payment. These payment cards may be issued by individual card companies or by financial institutions that are members of a payment organization (such as MasterCard International Incorporated). As used in this application, the term “payment card” includes not only physical payment cards, but also virtual payment cards in which the payment account information is stored in digital or electronic form, such as in a digital wallet. Each payment card is typically associated with a payment account.
During the past several years, a problem of growing concern to the payment card industry has been the compromising of payment account information in order to facilitate fraudulent transactions. For example, there have been numerous press reports on the exploits of Internet hackers who, in a single theft, have stolen the account data of ,thousands of accounts from merchant web sites. The account data may include payment account number, expiration date, cardholder name, and/or cardholder billing address. The stolen account data may then be used at direct merchants (e.g., mail-order, phone-order, and Internet-order merchants) to conduct fraudulent transactions. Another type of account compromise referred to as “skimming” is also a problem. Skimming is the process of copying a payment card's magnetic stripe information with an electronic reader. Since the magnetic stripe contains encrypted data for the purpose of verifying a card's authenticity, skimming permits criminals to manufacture counterfeit cards that cannot be distinguished from genuine cards by an issuer's authorization system.
Cases of account number compromise typically occur in clusters at certain merchants because of these merchants' sloppy security practices, employees of merchants acting in a criminal capacity, and/or the merchants themselves colluding with criminals. To prevent further fraud, it is important to identify the merchant locations at which account compromise has occurred. These merchant locations are commonly referred to as “points of compromise” or “common points of purchase.” Because a payment card has typically been used in valid transactions at many merchants by a cardholder once fraud has been detected, it is usually difficult to determine the point of compromise for the account.
For several years, however, sophisticated payment card issuers have performed “triangulation” analyses to identify common points of purchase for skimmed counterfeit cards. To perform these analyses, the issuers first identify payment accounts with which fraudulent transactions were conducted through point of sale (POS) terminals while the legitimate cardholders continued to have possession of their cards. Next, for each account used for fraud, the valid transactions preceding the fraud are identified. Transactions across all accounts are then compared to identify merchants at which more than one account was used in valid transactions. These merchants are designated as possible points of compromise (“PPOCs”). Other factors may be applied to narrow the list of PPOCs. For example, a merchant at which a high percentage of accounts handled had counterfeit fraud is more likely to be a PPOC than a merchant at which a low percentage of accounts handled had counterfeit fraud—assuming that each merchant transacted with a similar number of payment accounts. Payment accounts with few valid transactions prior to the fraudulent activities on the accounts may provide better evidence of points of compromise than accounts with many valid transactions prior to fraudulent activities on the accounts. Once the PPOCs are identified, subsequent investigation of each PPOC is required to confirm the identification of a merchant as a point of compromise.
For a card issuer to successfully apply the triangulation method described above, it is necessary that the issuer identify counterfeit fraud reliably and rapidly and have a sufficiently large number of accounts compromised at the same merchant. In the 1980's, MasterCard recognized that identification of PPOCs could be facilitated by analyzing transaction data from multiple issuers. A larger transaction database can furnish more complete information than the database available to a single issuer. Therefore, MasterCard implemented a system to identify PPOC using fraud reported to MasterCard by issuers and valid transaction data processed by MasterCard in its function of settling its members' accounts.